Trivy Supply Chain Attack - New Compromised Docker Images Found
Basically, hackers compromised Docker images used for software development, putting many projects at risk.
Aqua Security's Trivy vulnerability scanner faces a serious threat as new compromised Docker images are discovered. Developers using these images in CI/CD pipelines must act quickly to mitigate risks. The TeamPCP threat group is behind this attack, highlighting the ongoing challenges in securing software supply chains.
The Threat
On March 19, 2026, a significant supply chain attack was launched against Aqua Security's Trivy vulnerability scanner. This attack involved the injection of credential-stealing malware into official Docker images, specifically versions 0.69.4, 0.69.5, and 0.69.6. The malware is linked to the TeamPCP threat group, known for its malicious activities, including credential theft and more. Security researchers from Socket discovered that these compromised images were distributed through Docker Hub after attackers gained access via a GitHub Actions compromise.
The newly compromised images were uploaded on March 22, 2026, without corresponding GitHub releases, raising alarms about the integrity of the software. The presence of indicators of compromise (IOC) associated with the TeamPCP infostealer was confirmed in these images, indicating a serious escalation in the attack.
Who's Being Targeted
The attack primarily affects organizations using Trivy in their CI/CD pipelines. Developers relying on these Docker images for vulnerability scanning are at risk, as the compromised versions could lead to unauthorized access and data breaches. The incident has extended beyond just Docker images; it has implications for the integrity of development environments and the security of software supply chains.
Security teams are urged to review their recent CI/CD scans and consider them potentially compromised. The attack also briefly exposed an internal GitHub organization linked to Aqua Security, leading to unauthorized changes in dozens of repositories.
Tactics & Techniques
The attackers utilized a compromised service account token to gain access to multiple GitHub organizations. This method allowed them to rename and make public many repositories in a scripted burst, suggesting a high level of automation in their approach. The malicious binaries in the compromised Docker images contained typosquatted command-and-control (C2) domains and exfiltration files, indicating a sophisticated level of planning and execution.
The TeamPCP group has expanded its operations beyond credential theft to include ransomware deployment, cryptocurrency mining, and even destructive attacks targeting Kubernetes environments. This broadening of tactics signifies a heightened threat level and the need for organizations to remain vigilant.
Recommended Actions
Organizations using Trivy should take immediate steps to mitigate risks. Here are some recommended actions:
- Review CI/CD pipeline activity: Check for any unusual or unauthorized scans.
- Update Docker images: Ensure that only clean versions of Trivy are used.
- Monitor repositories: Keep an eye on any changes in your GitHub repositories that could indicate unauthorized access.
- Educate teams: Ensure that development teams are aware of the risks and know how to identify potential threats.
Aqua Security has confirmed that their commercial products remain unaffected, but the situation is fluid, and ongoing investigations are crucial to understanding the full impact of this incident.
Infosecurity Magazine